PHP2Shell: CVE-2026-109618 and CVE-2026-109619 (updated Oct 22, 2026) What happened: On Oct 21, 2026 PHP shipped emergency updates for two critical bugs that can let an attacker run code on the server without logging in. Security reports call the pair PHP2Shell. PHP's Oct 20 notice rated both CVSS v4.0 9.2. The bugs are CVE-2026-109618 (out-of-memory corruption) and CVE-2026-109619 (stale state left on a PHP worker).
Update, Oct 22: About 24 hours after the patches, scanning is widespread. Amazon reports the first probe on Oct 17, before the embargo ended, then broad exploitation attempts after the public release. Cloudflare says attempts rose from thousands before the announcement to millions afterward. WatchTowr says many public proof-of-concept scripts fail to get remote code execution and mostly crash or time the target. CISA urged organizations to update immediately. Updating PHP is still the only complete fix.
WordPress: This is the PHP version on the server. Updating WordPress, plugins, or themes does not patch it. Every WordPress site stays exposed until that PHP build is fixed.
Who is affected: Any PHP install that serves web requests, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP, and LiteSpeed. PHP says the risk is highest for mod_php: a demonstrated exploit can trigger from one request before WordPress code runs. Cloudflare also says the bugs affect web servers running PHP 5.4 or later.
Fixed versions: 8.5.12, 8.4.27, 8.3.36, and 8.2.35. PHP 8.1 and older no longer get updates from the PHP project. Some hosts and Linux vendors backport the fix, sometimes without changing the version number to those releases. PHP also published minimal source backports for 7.4, 8.0, and 8.1 for people who build PHP themselves. PHP says there is no complete workaround.
Cloudflare: Cloudflare turned on WAF rules for every plan, including Free, at 03:02 UTC on Oct 21, about 9 hours before the public PHP release. Free plans have the rules on by default. On Pro, Business, or Enterprise, confirm the Managed Ruleset is set to block. The rules only see traffic that passes through Cloudflare, and Cloudflare says they are an extra layer. Patch PHP anyway.
Do this now
Open Tools → Site Health → Info → Server and note the full PHP version. A hosting panel that only says 8.2 or 8.3 is not enough. Ask the host to install 8.5.12, 8.4.27, 8.3.36, or 8.2.35 for the branch you already run, then restart PHP. If you are on PHP 8.1 or older, move to a supported branch or get confirmation that the host package includes CVE-2026-109618 and CVE-2026-109619. Do not treat a WordPress, plugin, or theme update as the fix. If the site is on Cloudflare, leave the PHP2Shell WAF rules on. On Pro, Business, or Enterprise, confirm the Managed Ruleset is in block mode. Requests sent straight to the server IP skip those rules. Official PHP security advisory Cloudflare: WAF protections for PHP2Shell SecurityWeek: exploitation before and after the patches
